WARNING - employees risk jail if collecting private medical info incorrectly